Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 00:11
Behavioral task
behavioral1
Sample
saturnbootsrapper.exe
Resource
win7-20240221-en
General
-
Target
saturnbootsrapper.exe
-
Size
52.2MB
-
MD5
a9e1bc56479e53b1836459e9a9e5c551
-
SHA1
93cdd7964cdbaede24f958d7030d1f6906708a4b
-
SHA256
80c31b93b57a755b509f2ccc4152dbd825e6829eea8675fe18d02948f42bfbda
-
SHA512
0a266e6908916e6a4aa86800dc55a724fcbac64df211cf127d7c0de3db511438ad543954875c4db0cad0732bf69885019799c19b3b6bf9fc2d8de0ebfca4be0e
-
SSDEEP
393216:uWvz+q3VyoyUIC9urEUWj5EnBSVkRIrY87FNlqrMvxmouin93vt6a9kW/W:Pz+q30QdbQzcY87FziMZmylV6BM
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
saturnbootsrapper.exepid process 3048 saturnbootsrapper.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI8562\python312.dll upx behavioral1/memory/3048-105-0x000007FEF5510000-0x000007FEF5BD5000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
saturnbootsrapper.exedescription pid process target process PID 856 wrote to memory of 3048 856 saturnbootsrapper.exe saturnbootsrapper.exe PID 856 wrote to memory of 3048 856 saturnbootsrapper.exe saturnbootsrapper.exe PID 856 wrote to memory of 3048 856 saturnbootsrapper.exe saturnbootsrapper.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\saturnbootsrapper.exe"C:\Users\Admin\AppData\Local\Temp\saturnbootsrapper.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\saturnbootsrapper.exe"C:\Users\Admin\AppData\Local\Temp\saturnbootsrapper.exe"2⤵
- Loads dropped DLL
PID:3048
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5fb8bedf8440eb432c9f3587b8114abc0
SHA1136bb4dd38a7f6cb3e2613910607131c97674f7c
SHA256cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6
SHA512b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63